The access model, in four guarantees
Nobody sees more than they already would
All access is delegated: the assistant acts on behalf of whoever made the request, with the permissions that person already holds in Microsoft 365. Permissions ending in
.All mean “on behalf of the user, across everything they already reach”, not “access to everything in the company”.This screen is the organization's ceiling
Whatever is checked here is the maximum anyone in the company can have. Unchecking drops access for everyone, including people who had already allowed it on their own account. It is your revocation lever, and it is immediate.
Checking is not activating
Releasing here authorizes the organization. Each person still allows it on their own account before using it and, to write (send email, create an event, save a file), approves each action at the moment it happens.
SharePoint has two paths
Either you grant access site by site in Microsoft (fine-grained control), or you check the SharePoint rows on this screen (simpler, limited to what each person already accesses). Step 3 covers both.
What you do
1
Enable permission management
Connect your own Microsoft account under Conectores > Microsoft 365 (Connectors) and, in the Administração (Administration) tab, enable management.Microsoft asks for your approval on two permissions:
The second is the strongest on the list, so here are the safeguards, explicitly:
- There is no permanent credential: this capability lives only in your session, on an isolated connection, and the AI tools never receive it.
- The code only writes Morada’s own permissions. There is no path to grant anything else, or to grant it to another application.
- Your consent policy and directory role remain the real control: without the proper role, Microsoft refuses the operation.
- The tab does not appear for non-administrators.
On Microsoft’s consent screen the application appears as Morada OS. Managing permissions requires a role such as Cloud Application Administrator or equivalent in Microsoft Entra.
2
Release the permissions your organization will use
Still in the Administração tab, check what makes sense for your company. Each service opens into a list of individual permissions: you can turn on the whole service or pick permission by permission.OneDrive
SharePoint
SharePoint (all sites)
Outlook
Teams
Check only what the team will use now. Turning on more later takes ten seconds.
3
Grant access to SharePoint sites
Pick one of the two paths.Path A: site by site, in Microsoft. For each site the team should reach, grant the application permission on that site, choosing the role (read, or read and write). The grant is made through the Microsoft Graph API (
POST /sites/{id}/permissions). It is the only step that does not happen inside Morada OS, and that is deliberate: this is where you keep fine-grained control. Until a site is granted, it simply does not exist for the assistant.Path B: from the Morada OS screen. Check Sites.Read.All (to read) and Files.ReadWrite.All (to write) in step 2. You don’t have to touch any site: the assistant reaches the sites each person already accesses, never more than that, because access stays delegated.Path A is the most restrictive, path B the most practical. You can start with A and move later.4
Reconnect your account
Releasing permissions for the organization does not refresh your own session. Go back to Microsoft 365 and reconnect your account once: only then do the tools show as released for you. This applies to everyone, not just you.If you release something and test before reconnecting, it will look like it didn’t work.
What each person on the team does
1
Connect the Microsoft account
Under Conectores > Microsoft 365 (Connectors). The first sign-in asks only for identity (name, email, and permission to keep the session). No content access.
2
Use it normally
When a request needs something not yet released, a card appears in the conversation asking for that specific permission, and only that one, always within what you checked in step 2.
3
Approve each write
To send an email, create an event, or save a document, the person allows writing on their own account and approves each action before it happens. This applies to everyone, administrators included.
How to revoke access
Three paths, from fastest to most definitive:If something doesn’t work
The Administração tab doesn't appear, even though I'm an administrator
The Administração tab doesn't appear, even though I'm an administrator
Reconnect your account once. If it persists, tell Morada.ai: a setting in the application is missing, and only we can change it.
The tab appears, but releasing a permission fails
The tab appears, but releasing a permission fails
Your directory role does not allow managing tenant consent. A role such as Cloud Application Administrator or equivalent is required.
You released a permission and your tools are still blocked
You released a permission and your tools are still blocked
You still need to reconnect your account (step 4).
Someone connected and the assistant reads nothing
Someone connected and the assistant reads nothing
Expected: the first sign-in does not ask for content. The card that appears in the conversation is how each request unlocks what it needs.
The assistant reads everything but can't send email or save a file
The assistant reads everything but can't send email or save a file
Writing is a separate decision: check that the write permission is enabled in step 2 and that the person has allowed it on their own account.
It says connected, but nothing has worked for a while
It says connected, but nothing has worked for a while
Ask the person to unlink and connect again. If it repeats, talk to Morada.ai.
Security questions this page doesn’t answer: talk to Morada.ai before approving. One extra question beats a permission released without clarity.